#####################################################################################
#
# generic_epoch_timestamp.pl
#   If cookie data looks like an unix timestamp, try to decode it
#   
# Plugin Author: Ryan Benson (ryan@obsidianforensics.com)
#
#####################################################################################

package generic_epoch_timestamp;
use strict;

my %config = (friendlyName   => "Epoch Timestamp Decoder",
              description    => "Attempts to detect and decode potential epoch timestamps",
              artifactType   => "cookie",
              remoteLookups  => 0,
              browser        => "Chrome",
              browserVersion => 19,
              version        => 20120612);

sub getConfig       { return %config; }
sub getFriendlyName { return $config{friendlyName}; }
sub getDescription  { return $config{description};; }
sub getArtifactType { return $config{artifactType}; }
sub getRemoteLookups{ return $config{remoteLookups}; }
sub getVersion      { return $config{version}; }

sub pluginmain{

    my $select_h = $::datastore->prepare(" SELECT rid,value,derived FROM cookies  ");

    my $update_h = $::datastore->prepare(" UPDATE cookies SET derived=? WHERE rid=? ");

    $select_h->execute();
    my $counter = 0;
    while (my @row = $select_h->fetchrow) {
        unless ($row[2]){ # don't update if derived value already exists, as this plugin isn't as reliable 
            if ($row[1]=~/^(1(\d{9}|\d{12}))$/){
                my $derived = "Timestamp: " . ::EpochToHuman($1) . " [unknown - potential timestamp] ";    
                $update_h->execute( $derived, $row[0] );
                $counter++;  
            }
        }
    }
    ::printStatus("$counter cookies parsed");
}

1;
